Current release state
The release pipeline can build a wheel, create a canonical manifest v1, sign it with Ed25519, resolve dependencies from an offline wheelhouse, and verify the resulting release directory locally. External HTTPS publication validation is pending. No production release is published.
Manifest and signature
The manifest records format version, release version/channel/time, key ID, and every artifact's filename, type, exact byte size, and SHA-256. Canonical JSON bytes are signed; the detached signature is checked before pip receives the wheel.
Independent bootstrap
bin/eryon-bootstrap is independent from the wheel it verifies. It checks the signature against the configured trust anchors, parses the supported manifest format, validates artifact names/size/digest and wheel archive paths, then passes only verified local files to pip. It rejects non-HTTPS redirects and validates TLS using the platform trust store.
Verify before install
Use the bootstrap's help output to confirm the installed command options. Keep the public trust anchor in an administrator-controlled location delivered out of band; do not take a key from the release directory and trust it automatically.
eryon-bootstrap verify --help
eryon-bootstrap inspect --help
eryon-bootstrap install --helpLimits
The local rollback high-water file prevents routine accidental downgrade and serializes concurrent installs sharing that state. Root or the file owner can reset it. The mechanism does not provide protection against hostile root or a fleet-wide monotonic release service.